Malware
Ondritols
aka Onedrivetools
According to Symantec, this malware has been deployed against IT services companies in the U.S.
Ondritols, also known as Onedrivetools, is a Windows malware family.
Background
Symantec reports that this threat has been used against IT services firms across the U.S. and Europe. It operates as a multi-stage backdoor: the initial stage is a downloader that authenticates against the Microsoft Graph API, retrieves the second-stage payload from OneDrive, and runs it. That main payload fetches a publicly hosted file from GitHub, then creates a OneDrive folder named deviceId_n_<ip address> for each compromised host and uploads a file there to notify the operators that a fresh infection has occurred.
Source: Malpedia (Fraunhofer FKIE).